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IN THE CLAIMS 

The listing of the claims will replace all prior versions, and listings, of claims in the 
application: 

1 . (Currently Amended) An access control method performed by an access control 
system , including: 



receiving an initial access request for a service from a data processing 
apparatus; 

sending unique identification data to said apparatus in response to said initial access 
request; and 

applying a rate limit for verifying access to said service , using an access request queue, 
until said identification data is verified by received from a user of said apparatus and verified by 
said access control system . 

2. (Currently Amended) An access control method as claimed in claim 1, wherein 
verifying said identification data corresponds to a first level of access control, and said method 
includes applying at least one additional different level of access control following a 
predetermined number of failed attempts to verify said identification data by said user of said 
apparatus. 

3. (Currently Amended) An access control method as claimed in claim 2, wherein 
said identification data is a random unique security code; and 

said apparatus is sent an unique identification number for the apparatus, for sending with 
subsequent access requests and which expires if the security code is not verified within a 
predetermined period of time. 

4. (Currently Amended) An access control method as claimed in claim 1, wherein 
said identification data is verified by contacting [[a]] an independent communications device 
with a known association to said user and said data processing apparatus, and having said user 
provide said identification data using said device. 

5. (Currently Amended) An access control method as claimed in claim 1, wherein 
said identification data is verified by said user returning said identification data using an 
independent communication means having a known association to said user and said data 
processing apparatus. 

6. (Currently Amended) An access control method as claimed in claim [[2]]3, 
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wherein said at least one additional level includes detecting generation of access requests for said 
service under control of a program instead of under control of said user. 

7. (Original) An access control method as claimed in claim 2, wherein said at least 
one additional level of access control includes sending communication software to said apparatus 
to receive access requests for said service under an additional communication protocol. 

8. (Original) An access control method as claimed in claim 7, wherein said 
communication software encrypts said access requests. 

9. (Original) An access control method as claimed in claim 2, including invoking 
sequentially the levels of access control depending on the number of failed attempts to verify 
said identification data by said user for access requests over predetermined periods of time. 

10. (Original) An access control method as claimed in claim 6, wherein said at least 
one additional level of access control includes sending communication software to said apparatus 
to receive access requests for said service under an additional communication protocol and 
wherein said verifying of said identification data is a first level of access control, said detecting 
is a second level of access control, and said sending of said communication software and 
execution of said additional communication protocol is a third level of access control. 

1 1 . (Currently Amended) An access control method as claimed in claim 10, wherein 
said at least one_[[on]] additional level of access control includes a fourth level of access control 
involving blocking all access requests by said data processing apparatus. 

12. (Currently Amended) An access control method as claimed in claim 11, wherein 
said blocking involves denying all access requests that include address data or said unique 
identification number that corresponds to said data processing apparatus. 

13. (Original) An access control method as claimed in claim 12, wherein the address 
data is an IP address or segment. 

14. (Currently Amended) An access control method executed by a computer system, 
including: 

applying an access rate limi t, usinfi an access request queue, until a user issuing access 
requests is verifie d by said computer system ; 

invoking a first control level involving attempting to verify verifying said user; 

invoking a second control level applying hack program detection tests to said access 
requests and attempting to verify v e rifying said user; 
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invoking a third control level requiring use of predetermined download software for 
transmitting said access requests and attempting to verify verifying said user; 

invoking a fourth control level blocking access to said service on the basis of at least one 
communications address corresponding to said access requests; and 

invoking said control levels sequentially depending on a number of failed attempts to 
verify said user. 

15. (Currently Amended) An access control method as claimed in claim 14, wherein 
said user is verified by contacting [[a]] an independent communications device with a known 
association to said user and said data processing apparatus, and having said user provide 
identification data using said device. 

16. (Original) An access control system having components for executing the steps of 
the access control method as claimed in claim 1 . 

17. (Original) Access control software stored on a computer system, having code for 
executing the steps of the access control method as claimed in claim 1 . 

18. (Currently Amended) An access control system, including: 

an access control server for receiving access requests for a service from a data processing 
apparatus, rate limiting access to the server , using an access request queue, until a user of said 
apparatus is verified, and sending to said data processing apparatus unique identification data; 
and 

an [[IVR]] interactive voice response system for contacting [[a]] an independent 
communications device having an association with said user and said data processing apparatus, 
issuing a request for said identification data, and providing the identification data received from 
said user in response to said request to said access server in order to verify said user. 

19. (New) An access control method as claimed in claim 4 or 15, wherein said 
independent device is a telephone of the user. 

20. (New) An access control method as claimed in claim 5, wherein said independent 
communications means is a telephone of the user. 

2 1 . (New) An access control method as claimed in claim 1 , wherein said unique 
identification data is sent in a graphic format and received from said user in a different format. 

22. (New) An access control method as claimed in claim 6, wherein said detecting 
includes sending the unique identification data in a graphic format, and requesting a response in 
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a different format. 

23. (New) An access control method as claimed in claim 11, wherein said blocking is 
at a router level close to said apparatus. 

24. (New) An access control system as claimed in claim 18, whereas said independent 
device is a telephone of said user. 

25. (New) The access control method of claim 1, wherein the step of applying the rate 
limit for verifying access to said service comprises placing the access request in the access 
request queue when the rate limit is exceeded. 

26. (New) The access control method of claim 1, wherein the rate limit limits a 
number of access requests from said data processing apparatus over a period of time, until said 
user of said apparatus sends said unique identification data, and said unique identification data is 
verified. 

27. (New) The access control method of claim 14, wherein the rate limit limits a 
number of access requests from said data processing apparatus over a period of time, until said 
user of said apparatus sends said unique identification data, and said unique identification data is 
verified. 

28. (New) The access control method of claim 1 8, wherein the rate limit limits a 
number of access requests from said data processing apparatus over a period of time, until said 
user of said apparatus sends said unique identification data, and said unique identification data is 
verified. 
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